Question

Your organization wants a small team of identity engineers to manage the membership and settings of a specific set of highly sensitive groups that also carry role assignments. These groups are role-assignable (isAssignableToRole = true). You create a custom role with permissions to update group membership and assign it to the engineers scoped to those groups. However, the engineers report they cannot modify the membership of the role-assignable groups, even though they can manage other groups. What is the reason for this behavior?

Accepted Answer

Managing role-assignable groups requires the assignee to hold a privileged role such as Privileged Role Administrator or Global Administrator, not just group management permissions.

Answer

Custom roles cannot be scoped to individual groups; they can only be assigned at the tenant level.

Answer

Role-assignable groups must use dynamic membership, so manual membership changes are always blocked.

Answer

The engineers need the Groups Administrator built-in role because custom roles do not support any group membership permissions.